CVE-2015-6927
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root...
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
Exploit likelihood
What each source reports
NVD Score used
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
- Record
CVE-2015-6927- CVSS 2.0
- 3.6 Low
AV:L/AC:L/Au:N/C:N/I:P/A:P - Weakness
- CWE-59
- Updated
- 2026-11-02
CVE List No score
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
- Record
CVE-2015-6927- Updated
- 2026-11-02
EUVDEUVD-2015-6861 No score
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
- Record
EUVD-2015-6861- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h76c-22cc-xhhx No score
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root...
vzctl before 4.9.4 determines the virtual environment (VE) layout based on the presence of root.hdd/DiskDescriptor.xml in the VE private directory, which allows local simfs container (CT) root users to change the root password for arbitrary ploop containers, as demonstrated by a symlink attack on the ploop container root.hdd file and then access a control panel.
- Record
GHSA-h76c-22cc-xhhx- Weakness
- CWE-59
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vzctlDebian:8 |
before 4.8-1+deb8u2, plus listed versions 4.8-14.8-1+deb8u1 |
4.8-1+deb8u2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-6927 is a low vulnerability (CVSS 3.6) in Openvz Vzctl, published September 13, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 43rd percentile. Fixed in vzctl 4.8-1+deb8u2.